Application Media Usage

Evidence: Application Media Usage
Description: Collect Application Media Usage
Category: System
Platform: macos
Short Name: appmedia
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No

The KnowledgeC media usage stream records per-application media playback and consumption, including the owning application, playback duration, and, where available, the media URL behind the playback.

This collector gathers structured data about application media playback, including the application, media metadata, and timing. Results are recorded in app_media_usage.

This collector reads KnowledgeC databases under user profiles and records application media usage into app_media_usage.

This evidence ties a user to media content consumed at specific times, helping reconstruct activity timelines and revealing applications and content in use during an incident window.